# CVE-2026-9739: Google MCP Toolbox CORS bypass in SSE handler

Source: https://junglewise.ai/threats/cve-2026-9739-google-mcp-toolbox-cors-bypass-in-sse-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-9739 · Severity: critical · CVSS 4 · Published 2026-05-27

Google's MCP Toolbox for Databases, a tool used to connect AI models to data sources, contains a security flaw that could allow malicious websites to interact with a user's database. By bypassing security restrictions, an attacker could potentially steal sensitive information from connected databases like Postgres or BigQuery or execute unauthorized commands. This occurs because the software incorrectly allows connections from any web origin, ignoring safety settings configured by administrators.

Technologies: [github.com/googleapis/mcp-toolbox (Go)](https://junglewise.ai/threats/technologies/github-com-googleapis-mcp-toolbox), [Google MCP Toolbox](https://junglewise.ai/threats/technologies/mcp-toolbox), [Google MCP Toolbox for Databases](https://junglewise.ai/threats/technologies/mcp-toolbox-for-databases). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-9739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9739 being exploited in the wild.

**How severe is CVE-2026-9739?** Critical severity, with a CVSS score of 4, published 27 May 2026.

**Which products and versions are affected?** github.com/googleapis/mcp-toolbox (Go) < 1.2.0, SEMVER:introduced=0,fixed=1.2.0; Google MCP Toolbox v2024-11-05 specification users; Google MCP Toolbox for Databases < 1.2.0.

**Is there a fix for CVE-2026-9739?** Yes. github.com/googleapis/mcp-toolbox (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9739 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9739?** Check whether you run github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox or Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/googleapis/mcp-toolbox (Go): upgrade to 1.2.0 or later

  ```sh
  go get github.com/googleapis/mcp-toolbox@v1.2.0
  ```


## Technical details

The vulnerability stems from a hardcoded 'Access-Control-Allow-Origin: *' header in the SSE initialization handler within 'internal/server/mcp.go', which overrides global CORS middleware settings. This permissive policy, combined with the lack of host validation, makes the service susceptible to DNS rebinding attacks. An attacker can lure a user to a malicious site that uses the toolbox as a proxy to exfiltrate data or execute arbitrary tools against configured databases (e.g., Postgres, BigQuery). The issue specifically affects users utilizing SSE under specification v2024-11-05. The fix, introduced in version 1.2.0, removes the hardcoded header to allow the global CORS policy to correctly enforce 'allowed-origins' and 'allowed-hosts' flags.

## Affected products

- Google MCP Toolbox for Databases < 1.2.0

## Identifiers

- CVE-2026-9739
- GHSA-7pf3-8xx7-rvhf
- GO-2026-5870

## Timeline

- 2026-04-14: disclosed: Issue reported on GitHub
- 2026-04-16: patched: Fix merged into main branch
- 2026-05-27: advisory: NVD publication date
- 2026-05-28: advisory: GitHub Advisory published

## References

- [https://github.com/googleapis/mcp-toolbox/issues/3053](https://github.com/googleapis/mcp-toolbox/issues/3053)
- [https://github.com/googleapis/mcp-toolbox/pull/3054](https://github.com/googleapis/mcp-toolbox/pull/3054)
- [https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae](https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae)

## Related threats

- [Google MCP Toolbox for Databases path traversal via symlink](https://junglewise.ai/threats/cve-2026-102242-improper-link-resolution-cwe-59-cwe-22-in-the-allowedlocalroots)
- [Google mcp-toolbox authentication bypass in Google OAuth provider](https://junglewise.ai/threats/cve-2026-14541-google-mcp-toolbox-authentication-bypass-in-google-oauth-provider)
- [Google mcp-toolbox SSRF in HTTP source component](https://junglewise.ai/threats/cve-2026-14540-google-mcp-toolbox-ssrf-in-http-source-component)
- [Google mcp-toolbox denial of service in HTTP handler](https://junglewise.ai/threats/cve-2026-14539-google-mcp-toolbox-denial-of-service-in-http-handler)
- [Google mcp-toolbox auth bypass in bigquery-execute-sql](https://junglewise.ai/threats/cve-2026-14538-google-mcp-toolbox-auth-bypass-in-bigquery-execute-sql)